[MM-50948] Prevent popup windows from navigating outside of the plugi…

…n/managed resource URLs (#2580)
mattermost · Mar 6, 2023 · 3225076 · 3225076
1 parent 55529a9
commit 3225076
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/src/main/views/webContentEvents.ts b/src/main/views/webContentEvents.ts
@@ -187,6 +187,17 @@ export class WebContentsEventManager {
                             spellcheck: (typeof spellcheck === 'undefined' ? true : spellcheck),
                         },
                     });
+                    this.popupWindow.webContents.on('will-redirect', (event, url) => {
+                        const parsedURL = urlUtils.parseURL(url);
+                        if (!parsedURL) {
+                            event.preventDefault();
+                            return;
+                        }
+
+                        if (urlUtils.isInternalURL(serverURL, parsedURL) && !urlUtils.isPluginUrl(serverURL, parsedURL) && !urlUtils.isManagedResource(serverURL, parsedURL)) {
+                            event.preventDefault();
+                        }
+                    });
                     this.popupWindow.webContents.setWindowOpenHandler(this.denyNewWindow);
                     this.popupWindow.once('ready-to-show', () => {
                         this.popupWindow!.show();